0

I have a dedicated root server. I noticed strange connections from 255.255.255.255 in iftop. Because of that i tried to investigate it. I runned the following command:

 tcpdump -i eth0 ether broadcast and ether multicast

Here i get about 100 requests per second

16:21:13.174056 ARP, Request who has ****** tell ***** length 46
16:21:13.174406 ARP, Request who has ****** tell ***** length 46
16:21:13.174717 ARP, Request who has ****** tell ***** length 46
16:21:13.175351 ARP, Request who has ****** tell ***** length 46
16:21:13.175772 ARP, Request who has ****** tell ***** length 46
16:21:13.175923 ARP, Request who has ****** tell ***** length 46
16:21:13.250028 ARP, Request who has ****** tell ***** length 46
16:21:13.261960 ARP, Request who has ****** tell ***** length 46
16:21:13.334608 ARP, Request who has ****** tell ***** length 46
16:21:13.360883 ARP, Request who has ****** tell ***** length 46
16:21:13.361910 ARP, Request who has ****** tell ***** length 46
16:21:13.361919 ARP, Request who has ****** tell ***** length 46
16:21:13.363287 ARP, Request who has ****** tell ***** length 46
16:21:13.363297 ARP, Request who has ****** tell ***** length 46
16:21:13.365008 ARP, Request who has ****** tell ***** length 46
16:21:13.462835 ARP, Request who has ****** tell ***** length 46
16:21:13.464375 ARP, Request who has ****** tell ***** length 46
16:21:13.464954 ARP, Request who has ****** tell ***** length 46
16:21:13.565233 ARP, Request who has ****** tell ***** length 46
16:21:13.566120 ARP, Request who has ****** tell ***** length 46
16:21:13.567008 ARP, Request who has ****** tell ***** length 46

This looks not normal to me. There are many request from different IP-Adresses. Here is one example (domain is censored):

16:21:13.334608 ARP, Request who has mysql.example.com tell web1.example.com length 46

So web1.example.com is sending a request which Machine/Mac-Adress is responsible for hostname mysql.example.com. When i am correct i can now do ARP-Spoofing and tell web1.example.com that my Server is responsible for mysql.example.com.. So it's a man in the middle attack...

I have this problem only with one server at one provider. I never had that before. My colleague thinks also that it's a security risk / misconfiguration of router/switch in the datacenter..

Next strange thing: When i run command

arp

without any parameters i got a list with 20 different hostnames and mac adresses.

I have different servers, also at other providers. When i run those commands on my other servers i don't get any ARP Request and i only see my machine when i run arp without any argument... So what the heck is going on here?

2
  • This is part of the IP protocol, where did you got the idea it is a problem? Commented Dec 10, 2015 at 20:52
  • Are there really several different networks when running tcpdump -n arp Commented Dec 10, 2015 at 21:05

1 Answer 1

1

255.255.255.255 is not strange, it's an IPv4 broadcast address, and is used by various protocols. ARP spam may appear when there are network problems, or I've also seen it under normal circumstances; without knowing which IP addresses (are they gateway routers?) and the configuration of such, the traffic may or may not be nefarious. Talk to the networking team?

ARP spoofing can be a problem if there is someone naughty on the local subnet, though can be mitigated by appropriate network technology (802.1X, or locking particular MAC to particular network ports). But that's more a networking question. On the unix side, one can make static arp entries, though that may cause unexpected breakage if not coordinated with the network group or other teams.

arp will show hosts that have chatted up the system somehow, if a system shows none, then it may be on a subnet where broadcast spam is not common (e.g. a server-only network with services locked down, so no dynamic DNS or whatnot), or it could be a virt protected from broadcast traffic due to how that virt is networked.

6
  • The examples in the OP are for ether ff:ff:ff:ff:ff:ff, not 255.255.255.255 Commented Dec 10, 2015 at 20:54
  • @RuiFRibeiro okay, and?
    – thrig
    Commented Dec 10, 2015 at 21:03
  • As the OP is now, it just appears they do not understand how ARP/IP works, and yes, I do agree they do not see the same behaviour in other servers probably because they are in some virtual environment. Commented Dec 10, 2015 at 21:06
  • We now contacted the network team of data center. Within 7 minutes we receive about 20.000 requests from different ips's which has nothing to do with our servers. It's a dedicated root server which should be seperated from other servers in local network. I understand how ARP works, thats why i know that we (and others) would be able to run a man in the middle attack.
    – Dan
    Commented Dec 10, 2015 at 21:17
  • 1
    @Dan (If web is the most common ARP-issuer, and mysql the most common question, then there might be a heavily loaded web app looking for an unavailable database server. There's supposed to be exponential backoff to mitigate network spam, but not everyone does that right, or at all...)
    – thrig
    Commented Dec 10, 2015 at 21:32

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .